s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-dbfa0722045c839a8054e497896848d3c6714ee220c4ca96b2715efb8a99e210 high

📛 Threat Title

Vidar: dbfa0722045c839a8054e497896848d3c6714ee220c4ca96b2715efb8a99e210.exe

Category: Vidar Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: exe. Size: 6586288 bytes. Tags: exe, signed, stealer, vidar. Reporter: Kejult. First seen: 2026-09-25 11:21:20.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_imphash 4f2f006e2ecf7172ad368f8289dc96c1

IOC database

Type
hash_imphash
Value
4f2f006e2ecf7172ad368f8289dc96c1
First seen
Last seen
Attached to this threat
Appears in
61 threats
Description
imphash of URLhaus payload 774041365d4bc2b1…

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

hash_sha256 dbfa0722045c839a8054e497896848d3c6714ee220c4ca96b2715efb8a99e210 VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/dbfa0722045c839a8054e497896848d3c6714ee220c4ca96b2715efb8a99e210

IOC database

Type
hash_sha256
Value
dbfa0722045c839a8054e497896848d3c6714ee220c4ca96b2715efb8a99e210
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Vidar

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/dbfa0722045c839a8054e497896848d3c6714ee220c4ca96b2715efb8a99e210

hash_sha1 4c209b8e8db2055a7fbbaf17b8b2dc5e52f2e9fb VT 30 / 75

IOC database

Type
hash_sha1
Value
4c209b8e8db2055a7fbbaf17b8b2dc5e52f2e9fb
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 30 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious Trojan[downloader]:Multi/Wacatac.B9nj
Avast malicious Win64:Evo-gen [Trj]
AVG malicious Win64:Evo-gen [Trj]
Avira malicious TR/W64.Evo
Bkav malicious W32.Malware.94421288
CrowdStrike malicious win/malicious_confidence_70% (W)
Cylance malicious Unsafe
Cynet malicious Malicious (score: 99)
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.PWS.Steam.41641
Elastic malicious malicious (high confidence)
ESET-NOD32 malicious WinGo/Kryptik.ABP trojan
F-Secure malicious Trojan.TR/W64.Evo
GData malicious Win32.Malware.KillAV.C6DJWN@gen
Google malicious Detected
Gridinsoft malicious Trojan.Win64.Wacatac.cl
Ikarus malicious Trojan.W64.Evo
Kaspersky malicious Trojan.Win64.Agent.smhlar
Kingsoft malicious Win64.Trojan.Agent.smhlar
Lionic malicious Trojan.Win32.Vidar.4!c
Malwarebytes malicious Spyware.Vidar
Microsoft malicious Trojan:Win32/Wacatac.B!ml
Paloalto malicious generic.ml
Rising malicious Downloader.Remus!8.1E06E (CLOUD)
Sangfor malicious Trojan.Win32.Agent.V2fy
Sophos malicious Mal/Generic-S
Symantec malicious ML.Attribute.HighConfidence
TrendMicro malicious TrojanSpy.Win64.VIDAR.YXGIYZ
Varist malicious W64/ABApplication.SGUP-6924
Webroot malicious Win.Trojan.Gen

Details From VirusTotal

Basic Properties
MD58010669ee26e850f51fc56d10c74a9ad
SHA-14c209b8e8db2055a7fbbaf17b8b2dc5e52f2e9fb
SHA-256dbfa0722045c839a8054e497896848d3c6714ee220c4ca96b2715efb8a99e210
VHash066086656d15551d15545az2d!z
SSDEEP49152:0QHYT9T3v6FG62avHg+z9j2ljau20VQkZwirRCSvWXH1A0ZDm:0JlszdT9esswERCSvWFAj
TLSHT183665C0768944194CA5AD379E1BF5203EAB5BC19DB3572D3AE006D306F3A3D27AF6B04
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32+ executable (GUI) x86-64, for MS Windows
File size6.3 MB
History
First seen on VirusTotal2026-09-25 09:16 UTC
Last submission2026-09-25 09:16 UTC
Last analysis2026-09-25 19:02 UTC
Last modified on VirusTotal2026-09-25 21:04 UTC
Known Names
  • 11p9yplq.exe
  • xlhbu.exe
  • dbfa0722045c839a8054e497896848d3c6714ee220c4ca96b2715efb8a99e210.exe
hash_md5 8010669ee26e850f51fc56d10c74a9ad VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/8010669ee26e850f51fc56d10c74a9ad

IOC database

Type
hash_md5
Value
8010669ee26e850f51fc56d10c74a9ad
First seen
Last seen
Attached to this threat
Appears in
1 threat

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/8010669ee26e850f51fc56d10c74a9ad

References (1)

  • MalwareBazaar sample page Abuse.ch

    File type: exe. Size: 6586288 bytes. Tags: exe, signed, stealer, vidar. Reporter: Kejult. First seen: 2026-09-25 11:21:20.

Remediations (10)

  • Vidar Trojan Analysis, Malware Overview by ANY.RUN
    web:any.run

    Vidar is an information stealer trojan. It is either a fork of Vidar or the result of its evolution. Follow live malware statistics of this trojan and get new reports, samples, IOCs, etc.

  • PDF Vidar Stealer-Malware- - Blackpoint Cyber
    web:blackpointcyber.com

    Vidar Stealer is often deployed via social engineering attacks - phishing emails with malicious attachments and links - and drive-by downloads. Vidar Stealer has also been observed using malicious Google ads to spread the malware variant. Vidar Stealer has been observed impersonating legitimate software such as Advanced IP Scanner, Adobe Photoshop, Microsoft Teams, and Adobe Illustrator.

  • Vidar Malware Rewrites Its Obfuscation With Every Build to Make ...
    web:cybersecuritynews.com

    Vidar stealer evolves its code to evade detection while stealing passwords, cookies, wallet data, and system details from victims.

  • Deep Analysis of Vidar Information Stealer - eln0ty
    web:eln0ty.github.io

    Deep Analysis of Vidar Information Stealer 17 minute read On this page Vidar overview Sample Preparation (strings & dlls) Decrypt strings Building imports C2 Server How to understand the configuration format Folder generation Browsers 2 Factor Authentication software (2FA) Messengers Crypto Wallets Information log Result Other payloads Kill Task Exfiltration Conclusion Yara Rules Vidar (forked ...

  • Vidar: Windows Info-Stealing Malware Analysis - hunt.io
    web:hunt.io

    Explore Vidar , a Windows-based info-stealing malware. Learn about its data theft capabilities, distribution methods, and mitigation strategies.

  • Vidar Stealer: Malware Evolution & Acronis Defenses
    web:www.acronis.com

    Vidar is an infostealer that harvests credentials to enable initial access brokers and ransomware crews. Read our complete guide to Vidar defense.

  • Vidar Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    Vidar removal instructions Manual remediation can be risky, but professionals should start by isolating infected systems from the network. Use robust tools such as Huntress Endpoint Detection and Response (EDR) solutions or remediation tools to thoroughly clean the malware and restore affected systems safely.

  • Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer ...
    web:www.levelblue.com

    Remediation and Mitigation Affected systems should be immediately isolated from the network to prevent further data exfiltration and lateral movement. Given the capability to download additional malware, full system reimaging is strongly recommended to ensure complete eradication.

  • Hacked sites deliver Vidar infostealer to Windows users
    web:www.malwarebytes.com

    We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.

  • Vidar Trojan - Malware removal instructions (updated) - PCrisk
    web:www.pcrisk.com

    Once executed, the commands download a script from a remote server, injecting the Vidar malware (or Stealc). Instant automatic malware removal: Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.